Repository navigation
Type 2: include data about PAT expiry #1197
Description
Summary
When authenticating with a personal access token (PAT) a duration until the expiry of the token is returned by the login request.
This information is dropped by the python client, yet would be useful to have it logged as a warning when the expiration date is near.
Description
As users of the python client, we have automated some data-engineering tasks, and authenticate with PATs.
Since the PATs may be configured to expire after a given period of time, it is necessary to keep track of when tokens need to be renewed.
The time until expiry is available in the following REST Request:
https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_auth.htm#make-a-sign-in-request-with-a-personal-access-token
Since this request is already made as a part of the authentication process in the python client, I would like to extend the client to pass two optional parameters to the sign_in method:
- token_expiry_warning_threshold: Optional[int] = 60
- token_expiry_warning_callback: Optional[Callable[[str], None]]
The provided threshold should be an integer which represents days. If the token is set to expire in less days than in the threshold, a warning should be logged. I think 60 days is a sane default given the default expiration period is after 1 year.
A callable may also be provided which will be called with the string containing the time until expiry as received from the API. Its format is "days:hours:seconds".
Activity
kykrueger commentedon Feb 21, 2023
I'm willing to add this myself
kykrueger commentedon Feb 21, 2023
I'm now unsure if the value returned from the login request contains the time until the PAT expires, or the session token. Could someone confirm which of the two it is, if it is the later, then this feature request would require an API change.
jacalata commentedon Feb 22, 2023
This will require an API change, but it's already a known customer request so it might be in the works.
From https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#sign_in
An estimatedTimeToExpiration value is returned when you sign in using a PAT. The value represents the approximate time until the token returned from the PAT sign in will expire
kykrueger commentedon Feb 28, 2023
Thanks for the update!
Could you help me find a link to the customer request, so that we can get an update here once the server-side-update is complete?
That way we can get started on this once the blocker is out of the way.
jacalata commentedon Mar 1, 2023
Hmm I'm not sure there is one, but if I find it I will add it here.
[-]Type 1: support a REST API: Warning about PAT expiry[/-][+]Type 2: include data about PAT expiry[/+]mtsadler-branch commentedon Oct 10, 2023
@jacalata any update on whether
expiration_datewill be added to response when callingserver.auth.sign_in()?It's already a manual effort to refresh an expired token.
But it would be nice to have this
expiration_date, so we can preemptively alert our team that the token is expiring.The best solutions our team has found:
expiration_datein our logic, and alert when that date is approachingServerResponseErrorwhen callingserver.auth.sign_in(), to raise alert about expired tokenNote that:
CC @aharcarik-branch
jacalata commentedon Sep 20, 2024
This has been implemented server-side (in List Personal Access Tokens), but we haven't got it in tsc yet.
github-actions commentedon Aug 18, 2026
This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. If this is still relevant, please comment to keep it open.
jacalata commentedon Aug 25, 2026
Rechecked against current TSC — still a gap.
Auth.sign_inattableauserverclient/server/endpoint/auth_endpoint.py:69-94parses the sign-in response but dropsestimatedTimeToExpiration, and there is nopersonal_access_tokensendpoint wrapping List Personal Access Tokens (which exposes expiration server-side). Either surfaceestimated_time_to_expirationoff sign-in and/or add aserver.personal_access_tokensendpoint. Labeling as enhancement.